XGS, iOS 18, and RCS SMS

Hi Nathan Kuhl ,

Thank you for reaching out to the community, Pharming Protection is a feature that is only available in the web proxy and not in DPI mode.

IMP Points to Note:
DPI engine detects and filters HTTP and SSL/TLS traffic on any port.
Web proxy transparently handles traffic only on TCP ports 80 and 443.

My recommendation to use DPI mode, and if you continue to use web proxy then rest is very well explained in the article here.

Hmm I tried option 2 in that guide and it didn't seem to work for me.

Option 2 relies on the traffic hitting the firewall rule.  That relies on the FQDN host seeing the DNS requests for *.telephony.goog domains to capture the IPs associated.  You might be able to look at your logs and see the exact domain (and IPs) that it is using for your phone - but note this could change for every phone provider.

You could choose to use DPI for everything, at which point you no longer need a firewall rule to match on destination.

Option 2 relies on the traffic hitting the firewall rule.  That relies on the FQDN host seeing the DNS requests for *.telephony.goog domains to capture the IPs associated.  You might be able to look at your logs and see the exact domain (and IPs) that it is using for your phone - but note this could change for every phone provider.

You could choose to use DPI for everything, at which point you no longer need a firewall rule to match on destination.

I've narrowed *.telephony.goog, really rcs.telephony.goog, down to four IP addresses. I created a firewall rule using those four IP addresses and RCS is now flowing.